Re: [PATCH v2 3/7] mm/mremap: introduce and use vma_remap_struct threaded state

[Lorenzo Stoakes <lorenzo.stoakes@oracle.com>]

On Thu, Mar 06, 2025 at 10:33:59AM +0000, Lorenzo Stoakes wrote:
> A number of mremap() calls both pass around and modify a large number of
> parameters, making the code less readable and often repeatedly having to
> determine things such as VMA, size delta, and more.

[snip]

Hi Andrew,

I have a small fixpatch to address a corner case below, please apply!

I have checked locally and this applies cleanly at this patch and causes no
merge conflicts when subsequent patches are applied on top.

Thanks, Lorenzo

----8<----
From 14a22fa872e19b468b6d06c15205efe77e460ce4 Mon Sep 17 00:00:00 2001
From: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Date: Mon, 10 Mar 2025 10:13:17 +0000
Subject: [PATCH] always check if !vma

We perform VMA lookup in a couple more places which, in theory, can
unexpectedly fail to find a VMA.

In these cases, correctly indicate failure.

Signed-off-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Reported-by: kernel test robot <oliver.sang@intel.com>
Closes: https://lore.kernel.org/oe-lkp/202503101328.442cc724-lkp@intel.com
---
 mm/mremap.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/mm/mremap.c b/mm/mremap.c
index 0ab0c88072a0..af022e3b89e2 100644
--- a/mm/mremap.c
+++ b/mm/mremap.c
@@ -1066,10 +1066,13 @@ static unsigned long shrink_vma(struct vma_remap_struct *vrm,
 	 * replace the invalidated VMA with the one that may have now been
 	 * split.
 	 */
-	if (drop_lock)
+	if (drop_lock) {
 		vrm->mmap_locked = false;
-	else
+	} else {
 		vrm->vma = vma_lookup(mm, vrm->addr);
+		if (!vrm->vma)
+			return -EFAULT;
+	}

 	return 0;
 }
@@ -1108,6 +1111,8 @@ static unsigned long mremap_to(struct vma_remap_struct *vrm)
 		 * this can invalidate the old VMA. Reset.
 		 */
 		vrm->vma = vma_lookup(mm, vrm->addr);
+		if (!vrm->vma)
+			return -EFAULT;
 	}

 	if (vrm->remap_type == MREMAP_SHRINK) {
--
2.48.1